selinux: conditional expression type validation was off-by-one